Comment on Proton releases a new app for two-factor authentication
pulsewidth@lemmy.world 4 weeks agoIt is very wise to store your 2FA codes separately from your general login credentials. If one is breached, the other protects it (hence, two factor). If both are breeched, your account is hosed.
Same deal when setting up 2FA on an account and they provide some ‘one time use’ 2FA codes, they generally say ‘do not store these with your standard password credentials - keep them secure and separate’.
artyom@piefed.social 4 weeks ago
Correct. However it's worth noting that passwords are almost always compromised server-side. So 2FA is far more a mitigation of data breaches from the provider, rather than your password manager being breached.
pulsewidth@lemmy.world 4 weeks ago
Feels like everyone has forgotten when LastPass was breached, and that was barely three years ago.
Any affected LastPass users storing their 2FA backup codes in with the rest of their login data got a rude awakening.
Anyone who had them separate was at least able to rescue those accounts. But hey do what you like people, I know convenience usually trumps security.
artyom@piefed.social 4 weeks ago
As far as I know, passwords and TOTP keys were never leaked by LastPass. Regardless, I did say almost always.
pulsewidth@lemmy.world 4 weeks ago
That’s just scratching the surface. Peoples credentials are increasingly captured by information stealer malware, including attacks on Keepass. So that ‘almost always’ ain’t right regardless.
I agree of course, how the breech has occurred is important as to actions - if it’s just the website being breached and losing their passwords that has no impact on your 2FA codes. So ‘in most cases’ you might be fine, but peoples comp
The goal of 2FA is to be ‘something you have’ like an authenticator device or auth app on your phone, working as a secondary verifier that you are who you say you are to the ‘something you know’ being your password. So if you store 2FA codes with your password then you just have two sets of ‘something you know’ which is far less secure - and leaves you more vulnerable.
It doesn’t matter much with stuff like a forum account that has 2FA, but I certainly wouldn’t put any of my banking or key account 2FA backup codes or credentials in a password manager or central account/password storage service. It defeats the purpose.